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With over 500,000 gallons of liquid hydrogen and liquid oxygen, it is of vital importance to monitor the space 
shuttle vehicle (SSV) from external tank (ET) load through launch. The Hazardous Gas Detection System 
(HGDS) was installed as the primary system responsible for monitoring fuel leaks within the orbiter and ET. 
The HGDS was designed to obtain the lowest possible detection limits with the best resolution while 
monitoring the SSV for any hydrogen, helium, oxygen, or argon as the main requirement. The HGDS is a 
redundant mass spectrometer used for real-time monitoring during Power Reactant Storage and Distribution 
(PRSD) load and ET load through launch or scrub. This system also performs SSV processing leak checks of 
the Tail Service Mast (TSM) umbilical quick disconnects (QD’s), Ground Umbilical Carrier Plate (GUCP) 
QD's and supports auxiliary power unit (APU) system tests. From design to initial implementation and 
operations, the HGDS has evolved into a mature and reliable launch support system. This paper will discuss 
the operational challenges and lessons learned from facing design deficiencies, validation and maintenance 
efforts, life cycle issues, and evolving requirements. 

Nomenclature 


APU 

= 

Auxiliary Power Unit 

Ar 

— 

Argon 

COTS 

= 

Commercial Off-the-shelf 

CDEM 

= 

Continuous Dynode Electron Multiplier 

ECU 

= 

Electronic Control Unit 

ET 

= 

External Tank 

ET/IT 

= 

External Tank Intertank 

GLS 

= 

Ground Launch Sequencer 

GN2 

= 

Gaseous Nitrogen 

GUCP 


Ground Umbilical Carrier Plate 

H2 

= 

Hydrogen 

He 

= 

Helium 

HGDS 

= 

Hazardous Gas Detection System 

HWS 


Hazardous Warning Systems 

ID 

= 

Inside Diameter 

ISS 

= 

International Space Station 

ICC 

= 

Launch Commit Criteria 

LOD 

__ 

Limit of Detection 

mA 

= 

milliamps 

MPS 

— 

Main Propulsion System 

NIST 

= 

National Institute of Standards and Technology 

NSTS 

— 

National Space Transportation System 

02 

= 

Oxygen 

OMRS 


Operations and Maintenance Requirements Specification 

ppm 

= 

Parts per Million 

PRSD 

= 

Power Reactant Storage and Distribution 

QD 

= 

Quick Disconnect 

RGA 

= 

Residual Gas Analyzer 
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S0007 

= Launch Countdown Control Sequence 

SDS 

= Sample Delivery System 

SLPM 

= Standard Liters Per Minute 

SRB 

= Solid Rocket Booster 

SSME 

= Space Shuttle Main Engine 

SSV 

= Space Shuttle Vehicle 

TSM 

= Tail Service Mast 

VAB 

= Vehicle Assembly Building 


I. Introduction 

With over 500,000 gallons of liquid hydrogen and liquid oxygen, it is of vital importance to monitor the space 
shuttle vehicle (SSV) from the initiation of external tank (ET) loading through launch. The Hazardous Gas 
Detection System (HGDS) was installed as the primary system responsible for monitoring fuel and' oxidizer leaks 
within the orbiter and ET. The HGDS was designed to monitor the SSV for any hydrogen, helium, oxygen, and 
argon with the highest fidelity and resolution from off-the-shelf (OTS) components commercially available at the 
time of its design. The HGDS is a redundant mass spectrometer used for real-time monitoring during Power 
Reactant Storage and Distribution (PRSD) load and ET load through launch or scrub. This system also performs 
SSV processing leak checks of the Tail Service Mast (TSM) umbilical quick disconnects (QD’s), Ground Umbilical 
Carrier Plate (GUCP) QD's and supports auxiliary power unit (APU) system tests. From its initial implementation 
and operations, HGDS has evolved into a mature and reliable launch support system. This paper will discuss the 
operational challenges and lessons learned from facing design deficiencies, validation and maintenance efforts, life 
cycle issues, and evolving requirements. 

The Hazardous Gas Detection System is comprised of three different subsystems, a sample delivery system 
(SDS) and two redundant mass spectrometer systems (System A and System B). These systems were designed to 
utilize commercial-off-the-shelf (COTS) components to monitor for any hazardous situations during launch of the 
Space Shuttle Vehicle (SSV). Liquid Hydrogen and liquid Oxygen are the propellants used to fuel the SSV’s three 
main engines. It follows that H2 and 02 are the primary gas species of interest to be analyzed by the HGDS. 
Whereas GN2 is used to purge all SSV compartments, Helium is utilized throughout the SSV where potential H2 
leaks and associated flammability are to be mitigated (e.g., umbilical’s). Helium is additionally used to pressurize 
and drive flight commodities as well as the pneumatic source for valve actuation within the SSME. When 
monitored from a vehicle compartment, Helium may reliably indicate subsystem, QD and/or valve leakage. Argon is 
exclusively analyzed to determine if an increase in Oxygen is coming from the liquid 02 or from an air source (i.e., 
system intrusion). The HGDS’s major support role is during launch countdown control sequence (S0007) ET 
Cryogenic fuel load and during Terminal Count. 

S0007 ET Cryogenic Fuel Load and Terminal Count 3 are the most dynamic times for the SSV, making it the 
most crucial time for the HGDS. During terminal count, all SSV and ground systems are performing final 
configurations for launch. With Astronauts on board and the Solid Rocket Boosters (SRB’s) and Space Shuttle 
Main Engine (SSME’s) readied for ignition, it is vital to have the HGDS working at optimized performance to 
monitor for any significant increases in H2 or 02. Absence of leaks through loading reduces the probability but 
does not exclude the potential for leaks in terminal count where many significant events take place with a minimum 
of time for recourse. With only minutes left in the launch countdown, the oxygen tank and the hydrogen tanks are 
pressurized to highest pressure the tanks have been subjected to in the entire flow 4 . In its current configuration the 
HGDS is operated as a reliable, high fidelity system used to monitor during the critical launch events mentioned 
above as safety critical system. The HGDS 2000 has undergone several significant modifications and operational 
changes to better establish the system confidence the SSV launch team benefits from today. 


3 Terminal Count is the time in launch countdown from T-20 minutes and counting to launch at T-0. 

4 The flow, from the perspective of when the HGDS is utilized, is the time from when the orbiter rolls over to the 
VAB to be mated to the external tank through launch. This covers all testing, including orbiter mate to the ET, roll 
out to the launch pad, pad interface validations, and launch countdown. 
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II. HGDS System Overview 

The sample delivery system (SDS) draws all of the gas samples from sampling areas, as well as calibration 
bottles, using redundant dry scroll pumps through a series of valve manifolds. The SDS has the capability of 
sampling from up to thirteen different SSV areas/interfaces and twelve calibration bottles, five per each mass 
spectrometer and two shared between both mass spectrometer systems. The SDS is continuously sampling up to 
eight SSV areas, from which each mass spectrometer can pull a sample for analysis. To maintain the desired inlet 
pressure, the sample is pulled through a dual orifice system before entering the high vacuum chamber. The high 
vacuum chamber is maintained below 1.0e-5 torr using a turbo molecular drag pump that is backed by a dry scroll 
pump. Once inside the high vacuum chamber, the sample is analyzed for H2, He, 02, and Ar by a residual gas 
analyzer (RGA) that uses a quadrapole mass filter with continuous dynode electron multiplier (CDEM). 

The HGDS design requirements are spelled out in KSC-DL-3376 5 to have the following detection and range 
limits in Nitrogen background without Multiplier: Hydrogen = 30 PPM to 10%, Helium = 30 PPM to 100%, Oxygen 
= 30 PPM to 25%, and Argon = 9 PPM to 1%. The response of the RGA is required to be 90% of concentration 
within 15 seconds and the recovery of the RGA is required to be at or below 10% of concentration within 60 
seconds. The design requirements help to ensure the system is capable of monitoring for the Launch Commit 


5 KSC-DL-3376, Requirements for Performance, Design, Fabrication, and Certification of HGDS 2000. NASA 
requirements document for the HGDS. 
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Criteria 6 (LCC) that must be satisfied and verified in a time critical environment to be able to launch the space 
shuttle. These requirements for the HGDS include: 

less than 600 ppm hydrogen in the orbiter aft during ET cryogenic fuel load dropping to 150 ppm after 
load until LH2 automatic pressurization, when it increases to 240 ppm; 

- less than 500 ppm oxygen in the orbiter aft; 

- No increase above baseline for hydrogen and oxygen in the ET/IT, Midbody, and Payload Bay. 

All of these specific concentration values are based on acceptable leak rates in the specific areas of the space shuttle 
vehicle. 


III. HGDS Operations 

A. Validation 

Preventive and corrective maintenance efforts are focused on ensuring the system is kept in optimum 
condition. Currently, there is an HGDS system in each of the two operational mobile launch platforms. Each system 
must be validated prior to its first use on every vehicle processing flow, which is the time the orbiter rolls over to the 
Vehicle Assembly Building (VAB) to be mated to the ET through launch. Validation of the HGDS is dictated by 
the governing Hazardous Gas Detection System Daily Operations/ Validations document. • This 1000 page document 
contains the technical operations that ensure the HGDS is 100% operational prior to use during an integrated 
processing flow. The validation document has been through seven revisions and takes approximately one month to 
run through all the required operations. This rigorous testing is designed to expose any problem with the system. 
When a problem is found, it must be addressed immediately. Problems can add significant time to the validation as 
any affected part of the system must be revalidated. The validation of the system is primarily composed of leak 
checks and RGA characterization. 

Leak checks ensure the integrity of the system. This allows any gases seen during integrated operations to be 
attributed to the area being sampled instead of another sample line or the compartment in which the HGDS is 
located. Leak checks involve testing every possible pneumatic configuration of the system to ensure it is meeting 
the Operations and Maintenance Requirements Specification 7 (OMRS) allowing a vacuum decay leak rate less than* 
2 torr in fifteen minutes. Leak checks cover twenty-two total sample and calibration lines, a high vacuum manifold, 
and shared sample delivery components. The time required to pump down each line and perform each leak check 
can readily consume time that is needed to validate other system components. 

RGA’s are rigorously analyzed for drift and noise to ensure optimum performance during launch. Each RGA 
undergoes: 

- a check for ionizer contamination, 

- tuning to ensure proper peak shape for each gas species, 

- automatic calibrations for determination of accuracy, 

- linearity checks to ensure proper ion current response. 

Finally, RGA performance is analyzed against requirements set forth by the original system requirements 
document. This document, KSC-DL-3376, spells out the operational requirements of the HGDS. In order to analyze 
the level of contamination of the ionizer, the ion current for water is monitored while sequentially selecting gases 
with increasing concentrations of hydrogen and oxygen. The ionizer is considered to be contaminated and must be 
replaced if the water ion current increase occurs during this sequence and it coincides with a continuous downward 
drift in hydrogen and oxygen. Studies 8 performed in the HGDS lab and in conjunction with ASRC Aerospace 
Corporation have attributed this contamination to sudden pressure changes in the high vacuum that cause the 


6 “Shuttle Launch Commit Criteria and Background Document. SECTION 40 - Hazardous Gas Detection System,” 
NSTS 16007 - REVISION H, Change No. 1 12, Program Requirements Control Board Directive No. S072380NE/ 
(1-1), 2010. This document spells out the specific requirements, contingencies, and backgrounds for launch. 

7 NSTS 08171, SPACE SHUTTLE, Operations and Maintenance Requirements Specification, FILE VI, VOL. 1, 
Baseline 14, Hazardous Gas Detection System. This document spells out the specific requirements to be met each 
flow for operations and maintenance. 

8 Oxygen drift and Inlet Study was performed in the United Space Alliance, LLC HGDS Lab and in conjunction 
with ASRC Aerospace Corporation. Results were reported in KSC-PH-7983 - Post-Oxygen Drift Modification 
Report for the HGDS 2000 System. 
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thoriated iridium on the filament to vaporize and then become deposited on the anode grid; consequently, changing 
the characteristics of the RGA. To address this problem, a software modification was implemented to delay the 
filament from being energized until completion of system power up and establishment of high vacuum as well as to 
delay system power down until the filament has been deenergized. These procedures ensure that the high vacuum 
chamber is completely evacuated prior to filament operation and that the filament has had sufficient time to cool off 
before the high vacuum is subjected to atmosphere when the system is powered off. Contamination may also stem 
from handling while the component is not installed in the system. 

Additionally, the RGA is evaluated across increasing gas concentrations to verify a linear response across a 
dynamic range of highest operational interest to established launch commit criteria. Originally, the emphasis of this 
evaluation focused on the accuracy. of the numbers with multipliers off. Current focus has shifted with operations to 
evaluate the accuracy, as well as signal drift or stability, with multipliers on. 

The RGA’s are used in unique conditions specified by the HGDS system requirements document. These 
systems must operate in air and nitrogen backgrounds, be ready to detect large leaks, and be able to distinguish 
smaller, transient leaks of only a few parts per million (ppm). HGDS systems are required to monitor the orbiter for 
the duration of external tank cryogenic fuel loading through launch, ET fuel load lasts approximately three hours. 
This period is operationally dynamic, allowing no time to recalibrate the HGDS without losing launch critical 
visibility of sections of the orbiter. Hence, HGDS systems must be reliable to within 10% of the test gas 
concentrations for hours. 



Figure 2 9 . The Probe Portion of the Residual Gas Analyzer used within the HGDS. The probe of the RGA 

consists of four main components - the Ionizer that creates the positive ions; the ion filter that filters out any gas not 
of interest; the CDEM which amplifies the ion current signal; and the ion detector that measures the ion current. 

B. Drift 

To support loading and terminal count as mentioned above, the HGDS stabilizes for hours on high quality 
gaseous nitrogen (GN2) gas prior to performing an automatic calibration with up to four calibration gases As 
originally installed, the HGDS would demonstrate significant oxygen drift when the span gas calibration line was 
selected. The oxygen concentration would drift as much as 2000 ppm or 40% of the span gas certified oxygen 
concentration after extended periods of operation. This drift caused the automatic calibrations to routinely fail to 
attain less than 10% error on oxygen. This failure was outside of requirements and a study was initiated to 
characterize the drift and determine a fix to the HGDS, reference report KSC-PH-7983 and KSC-PH-6920 9 10 . 

A spare HGDS is maintained in the USA HGDS lab, intended to be used as a ‘hot spare’. A ‘hot spare’ is a 
known working spare ready to support in case of a last minute failure on an operational system. The lab system may 
additionally be used for prototyping and troubleshooting. The lab HGDS spare was used to characterize the oxygen 
drift seen on span gas after extended periods of operation and the ultimate fix was reported on by ASRC Aerospace 
Corporation, the design agency responsible for the design of the HGDS, in the KSC-PH-7983 and KSC-PH-6920 
report. Testing involved recording a baseline and then comparing to alternate configurations including a different 
mass spectrometer, a heated inlet system, and a different high vacuum chamber. The results from the lab testing 
showed no improvement in oxygen drift between a heated inlet and a different mass spectrometer, although the 
recovery time for oxygen improved slightly with the heated inlet. The most significant result was found while using 
the same mass spectrometer utilized in the HGDS but coupled to a different high vacuum chamber with twice the 


9 This is an image of the probe from the Stanford Research Systems Operating Manual, used within the HGDS. 

10 KSC-PH-6920 - Vacuum Chamber Modification of HGDS 2000 reported on the vacuum chamber effects on the 
system characteristics including drift. 
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inner diameter at the turbo pump intake. In the original design of the HGDS, the high vacuum chamber was a 
custom 1 .5 inch inside diameter (ID) 90 degree bent tube whereas this piece of test equipment used a COTS, 3 inch, 
ID, adapter flange from the mass spectrometer to the turbo pump. Additionally, as stated in the Post-Oxygen Drift 
Modification Report for the HGDS 2000 System, KSC-PH-7983... ‘using an electro-polished inlet block, and a 
bellows intake valve appear to alleviate this form of oxygen drift.’(Arkin, pg 2) When the COTS high vacuum 
chamber and the electro-polished inlet block were installed in the HGDS lab system the report additionally states 
that 02 drift was reduced on average -1200 ppm and 211 ppm while on span gas and on zero gas respectively. This 
preferred behavior was not specifically called out in the original requirements document. Rather, it was not until the 
systems were used in launch support that the importance of such drift was noted. All HGDS systems have some unit 
to unit performance variations as accumulated from each subsystem component variance. In the described launch . 
support environment, it is difficult to confirm system trends such as signal drift without analysis of calibration gases, 
which would detract from the requirement to monitor vehicle areas without interruption. 

The HGDS is currently operated in multiplier mode throughout support of ET loading and launch countdown. Signal 
drift analysis is now therefore emphasized during system validation. 

During ET load, helium is the highest concentration gas monitored within the aft; nominally around 6000 ppm 
because of all the helium purges and helium actuated valves in the area. During a recent mission, significant 
concentration differences were seen in the aft area during cryogenic fuel loading. The helium on one system drifted 
negative, while the other drifted positive. Further analysis of this type of drift has been performed in the MLP 
systems, as well as in the lab. This analysis has shown that, in multiplier operation, the system is more susceptible to 
drift with higher concentrations of gas species and will show the drift across all gas species (not j ust oxygen as 
discussed previously). The system seems to show a saturation effect with the high concentrations of gas while in 
multiplier mode. This characteristic has led to a new test method that has been incorporated during validations and 
just prior to S0007. 
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Figure 3. Dynamics in the Orbiter Aft During External Tank Loading, (a) The blue line represents oxygen, Red 
represents Hydrogen, Green represents Argon, and black represents Helium as read by the HGDSB plotted with 
ppm on the y-axis vs. time on the x -axis. Other significant ET load events are plotted as well, (b) The plot shows the 
various levels of the different gas species present in the orbiter aft during ET load, (c) With HGDSA still 
monitoring, HGDSB had to perform a test gas check to verify the accuracy of the readings, causing an interruption 
in monitoring on the aft for system B as seen at 0936 GMT reading. 

The new operational evaluation of the system involves looking at the drift on Nitrogen test gas over ten to twenty 
minutes which subjects the multiplier to higher ion currents over a longer period of time. The system is considered 
acceptable if the gas concentration stay within the 10% accuracy requirement over that time period. From the recent 
analysis, the most likely causes of the negative drift are attributed to multiplier degradation, which an increase in 
multiplier voltage often mitigates. In contrast, upward drift in multiplier operation is still under investigation. The 
most likely sources of the positive drift have been attributed to degradation of the RGA’s electronic control unit 
and/or contamination within the quadrapole. Even though the exact cause of this new type of drift across all gases at 
higher ion currents has not been determined, the new operational evaluation methods have proven to sufficiently 
characterize the performance of the RGA prior to use; consequently, the best equipment has been identified and 
installed. These new operational methods add a significant amount of confidence during launch support so that 
system behavior is more consistent and predictable. 

C. HGDS Pumps 

Component failures and failure rates are a reality in the operations of the HGDS. The components in the HGDS 
that see the highest workload are the various pumps throughout the system. There are four higher capacity dry scroll 
pumps used as the sample and transport pumps. The sample pumps are used to draw the gas samples from the 
sample delivery system, at an average flowrate from 0.5 to 1 slpm, past the inlet of the high vacuum area to be 
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analyzed. The transport pumps are used to pull the samples from the various points of interest around the vehicle, at 
a total capacity of 34 slpm. These areas include: 

- orbiter Aft, 

orb iter Midbody, 

- orbiter Payload Bay, 

- ET/IT (the intertank of the external tank which is the area between the exterior walls of the tank and 
the inner hydrogen and oxygen tanks), 

- Tail Service Mast (TSM - through which the hydrogen fill line is routed). 

Additionally, there are two smaller capacity dry scroll pumps used as turbo backing pumps. Finally, there are 
two turbo molecular drag pumps used to maintain the high vacuum for the RGA. 

/. Turbo Pumps 

There have been many lessons learned associated with the turbo pumps used. The primary criteria used to select 
the turbo pumps that were originally installed in the system was pumping capacity and compression ratio. Hydrogen 
and helium molecules are difficult to pump efficiently; therefore, the right combination of pumping capacity and 
compression ratio is vital. Since the HGDS is used to detect leaks during launch countdown with major time 
constraints, the system must additionally be able to quickly clear out any gas that it does see during operations 
without building a background The turbo pumps operate at approximately 42000 rpm. Hence machining on the 
turbo pump components must, be within stringent tolerances and the bearings must be designed to handle the 
considerable stress for long periods of time. Bearing failures within the turbo pumps has been the predominant 
failure mode encountered during operations. Even with procedures that take every precaution possible to distribute 
the bearing grease and operate the pumps under ideal conditions, failure frequency remains an issue. Within the 
pool of turbo pumps currently installed in systems operating in the launch environment, failures are seen within the 
first 1500 hours. The turbo pumps currently utilized in the HGDS are the second model of pump that has been used 
in the system. They are also the second type of pump to be discontinued by the vendor. 

Obsolescence is a constant concern because of the stringent acceptance testing and qualification that the 
pump must undergo prior to installation into an operational system. Qualification of a new model turbo pump can 
take months to complete. Such testing must verify that no operational capabilities will be lost by installing the new 
model. New equipment, such as turbo pumps, also may necessitate system software modifications that require 
additional qualification and testing. The testing involves running the system line by line through the requirements 
spelled out in the requirements document and verifying the results are within specification. Response of the RGA 
should be 90% of concentration within 15 seconds and recovery of the RGA should be at or below 10% of 
concentration within 60 seconds. From bearing failures to obsolescence, there are many problems that have to be 
dealt with on a day-to-day basis prior to even making it to launch. 

2. Transport and Sample Pumps 

The dry scroll pumps used for the turbo backing, transport, and sample pumps present problems with tip seal 
dust. This dust is capable of contaminating the system, causing blockages, and causing inlet and roughing pressure 
degradation. This tip seal wear introduces a significant amount of contaminate into the exhaust and can even 
backflow into the system. A pump study was performed by ASRC Aerospace Corporation, KSC-PH-7984 11 , to 
evaluate the various pumps available to try and find a better fit for the system while producing less tip seal dust. 
With the results, a pump modification was performed wherein some pump capacity was sacrificed to obtain less tip 
seal wear and higher reliability. On average, the pumps first used as transport and sample pumps were replaced 
within less than 10000 hours of operation. Since the pump upgrade, there have been no sample or transport pump 
change outs, with most pumps in place already having greater than 10000 hours runtime. 

3 . Turbo Backing Pumps 

The KSC-PH-7984 pump study was also used to evaluate turbo backing pumps. With lower flow and 
maintaining a rough vacuum of ~le-2 torr, they also wear faster, causing a higher number of pump change outs that 
interrupt operations at the cost of time and effort. In addition to the effort required to replace degraded or failed 

11 KSC-PH-7984, “Evaluation of Dry, Rough Vacuum Pumps” was performed by ASRC Aerospace Corporation to 
test and evaluate multiple types and models dry, rough vacuum pumps over time. 
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components, the retest can be even more involved to ensure nothing was damaged in the process of replacement and 
to verify the integrity of the affected areas within the system. Failure rates on the original model turbo backing 
pumps were high, typically being replaced with less than 4000 hours. The minimum maintenance period anticipated 
based on initial design was over 6000 hours. This difference showed that pumps were degrading and requiring 
replacement about three months prior to the expected interval. A modification was performed to enlarge the exhaust 
tubing on the pumps, as well as upgrading to a newer model pump with a lower horsepower and operating 
temperature. This modification also included the use of a filter on the air flush port to improve the clear out time of 
the pump, whereas previously, the air flush port was plugged. With the new, more efficient pumps, and less 
backpressure on the pump exhaust, there have been no pump change outs for the new model turbo backing pump. 
Most of the new model turbo backing pumps, with the new exhaust configuration, currently have greater than 5 G00 
hours runtime while maintaining requirements. 


D. Failures 

Failures in a launch critical system have to be thought of differently than in a processing or lab environment. 
Failures during launch support cannot be tolerated, so if any component shows the slightest anomaly, it is 
investigated fully and typically the component is replaced and revalidated. Failures in launch critical systems can 
result, and could shortly follow anything that is not nominal. If a turbo pump consistently operates at 230 mA and 
then starts to show an increased average to 280 mA, with spikes to over 500 mA, this pump would likely be 
removed and replaced. There is an operational history that shows the pump current will continue to increase and the 
pump will continually work harder and harder. Even though the high vacuum pressure is maintained, the pump is 
not operating nominally. The pump could possibly continue to maintain the proper high vacuum for days; however, 
the launch cannot rely on ‘possibly’. Operational experience shows that a turbo backing pump typically maintains 
<10e-2 torr. If the base pressure goes into the 10e-l range, operational experience suggests the tip seals are starting 
to degrade and the pump is replaced. In this case, the pump is factually within vendor specification and still 
maintaining the specified range for the turbo pump, however, this symptom of degradation could lead to a hard 
failure or put undo stress on the turbo pump. These indications show a potential component problem and could 
eventually lead to a failure. Components are replaced at the first sign of degradation or at the first indication that is 
not nominal. 

Failures within the HGDS also involve a component degrading to the point that it causes a specific requirement 
to not be met. In addition to the pumps within the system, the valves for the calibration lines and the sample lines 
see the highest workload. With over thirty valves in the HGDS, these components account for some of the highest 
failure rates within the system. The valves used are quick response, 3-way, 2-position solenoid actuated valves that 
are routinely energized for hours. Rarely has the valve failed completely by not changing position. The main failure 
mode for these valves is leakage. Most typical of this failure mode, the seats within the valve wear sufficiently to 
fail the leak checks performed during validation by exceeding the two torr in fifteen minute specification. 
Depending on the valve that is leaking, it could introduce air into the system causing a failed automatic calibration 
or false leakage indication. In these cases, the valve must be replaced and impacted parts of the system must be 
retested to meet requirements. 


E. Calibration Gases 

The HGDS needs to be as accurate as possible. With the oxygen drift, there was a clear problem resolution 
through a hardware change that was able to increase accuracy. With time the question was presented as to how one 
could verify gas cylinders used for calibration. The calibration cylinders being used were certified by the vendors 
who provided them and all used methods that were National Institute of Standards and Technology (NIST) 
traceable. Every component in the system adds a certain amount of error. Using three different gas cylinders, each 
with their own inherent error, introduces a significant amount of uncertainty in the ultimate accuracy of the system. 
There is a possibility, though improbable, that a set of cylinders from a vendor could all be just within tolerance, 
either to the high side or the low side. This error could shift the entire curve high or low. Depending on the redline 
requirement for launch, this could artificially reduce the launch criteria threshold (possibly resulting in a delayed 
launch). In contrast, when raising the threshold, such a shift could cause an actual violation to be masked (resulting 
in an unidentified hazardous situation). These are two unlikely scenarios but with a crew aboard the vehicle, this 
unlikely situation required examination. 
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A review of operations and requirements took place to determine the best way to achieve the highest confidence 
in the calibration cylinders used on the HGDS. Procedures were developed to use the HGDS lab system to analyze 
any new calibration gas cylinder received prior to installing it on a system in the field. With these procedures in 
place, calibration gas analysis began to identify inconsistencies between gas bottle certifications and analyzed values 
that were unacceptable. It was discovered that a vendor providing the calibration cylinders was having trouble 
separating and analyzing Argon. This resulted in calibration gas cylinders that were out of tolerance. All of the 
vendors used to obtain calibration cylinders certified the gas concentrations using NIST traceable standards. NIST 
standards are the most accurate certifications that can be achieved. When a standard is NIST traceable, it was at one 
point certified using NIST procedures and a primary standard, yet could be certified by a secondary or tertiary 
standard now. The ideal solution would be to obtain several sets of NIST made and certified primary standards, 
however, a balance must be struck between accuracy, cost, and lead time on procurement. The lead time and cost to 
obtain NIST made and certified primary standards were not feasible to support operations and budget. The decision 
was made to have a vendor provide a set of calibration gas cylinders that would be sent to NIST where they would 
be analyzed and certified. Using NIST certified gas cylinders provides the best combination of cost, procurement, 
and accuracy, and removes any question about the confidence in the calibrations of the HGDS. 

During the process of obtaining NIST certified calibration cylinders, the concentrations of the calibration gases 
was assessed. Originally, the HGDS used calibration gas concentrations based on the previous system that were 
basically chosen to cover the entire range of concentrations seen during operations. These values were 0 ppm, 500 
ppm, and 5000 ppm for Hydrogen and Oxygen. However, these were not the launch commit criteria (LCC) redlines 
and the range was far above what was nominally seen during launches. The LCC redline is the limit that determines 
whether it is a ‘go’ or ‘no go’ for launch. With this in mind and new calibration gases being mixed for NIST to 
certify, the concentrations in the calibration gases were changed to match the LCC redline limits. 

F. Leak Detection Limits 

Every mass spectrometer’s has a unique linear dynamic range. Outside of this range the system responds 
nonlinearly. The HGDS was originally calibrated with a 2 point calibration curve that used a ‘zero’, and ‘span’ 
bottle with an external ‘test’ gas reference. Originally, the calibration curve was forced to zero using 100% GN2 as 
the ‘zero’ gas in the calibration curve. Operating this way forced the lower part of the curve, which was outside the 
linear dynamic range, onto a linear scale. This resulted in a 0 ppm reading with no gas species of interest present, 
but skewed the accuracy of the system in the presence of low levels of hydrogen, oxygen, helium, or argon. The 
effects of this calibration curve were minimal during ET load when looking for gas concentrations 150 ppm and 
above. However, when trying to identify ‘no increase above baseline’ during fuel cell load, forcing the calibration 
curve to zero caused inaccuracies in the exact range of interest. Examining the operation closer resulted in changing 
the procedure to take into account the linear dynamic range of the mass spectrometer. Instead of calibrating with 
100% GN2 as the ‘zero’ gas, the new calibration procedure used a bottle with gas concentrations just inside the 
linear dynamic range of the system. This new procedure resulted in an elevated zero reading with no gases present, 
but greatly enhanced the accuracy of the system with minimal gas concentrations. 



Figure 4. Linear Dynamic Range. Using the system in multiplier mode and focusing on the bottom part of the 
linear dynamic range has significantly improved the limit of detection and the resolution of the HGDS. 
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With changes to the calibration gases and procedure providing ever increasing fidelity, the requirements for the 
system were revisited. The system was now capable of differentiating between a few ppm and was more than 
capable of analyzing gas concentrations at the LCC redline limits. However, during fuel cell load there is a 
requirement to have ‘no increase above baseline’ for oxygen and hydrogen. This resulted in the question of how to 
define the baseline and how to define an increase. The standardized way developed to define an increase was based 
off of the LOD or limit of detection and resolution of the system. Previously, the operating baseline of the HGDS 
was so noisy that, unless there was a major leak, small leaks could go unseen during fuel cell load. With the newly 
implemented calibration procedures and increased fidelity of the HGDS, the system was now able to distinguish 
slight increases during fuel cell load that had previously been masked. The mass spectrometer is only capable of 
accurately analyzing above a certain concentration (LOD) and then is only able to distinguish differences of a 
minimum value (resolution). 

The way LOD and resolution is evaluated operationally for the HGDS is using zero gas (100% GN2) and the 
lowest certified gas concentrations available, which is the PRSD gas cylinder containing 25 ppm H2, 50 ppm He, 25 
ppm 02, and 25 ppm Ar. Using a minimum of 30 data points, equation 1 is used to calculate LOD. 


. LOD = (3* PC)* 


PC = Certified Concentration of PRSD Calibration Gas 
PSTD = Measured Standard Deviation of Minimum of 30 Data Points on PRSD Calibration Gas 
PA = Measured Average of Minimum of 30 Data Points on PRSD Calibration Gas 
ZA = Measured Average of Minimum of 30 Data Points on GN2 Zero Calibration Gas 


PSTD 
( PA-ZA ) 


( 1 ) 


Resolution of the system is calculated using three times the measured standard deviation of a minimum of 30 
data points on PRSD calibration gas. Previously, the operational standard definition for increase above baseline was 
set at anything greater than or equal to 5 ppm. Since implementing the multiplier mode and using this method of 
calculation, the HGDS typically has an LOD and resolution for Hydrogen in the range of 0.9 - 2 ppm and for oxygen 
in the range of 0.9 - 3 ppm. Operationally, this means that during fuel cell load, the HGDS can typically observe a 
hydrogen leak of greater than 1 .5 ppm and oxygen leak of greater than 2 ppm, as opposed to 5 ppm. Figure 4 
represents data from PRSD load, during which transient oxygen leaks of 3.8 ppm (during automatic pressurization at 
the end of oxygen load), and 3.4 ppm (during automatic pressurization at the end of hydrogen load) were observed. 
Because of the low LOD and resolution calculations for the system, the HGDS was able to distinguish these low 
level transient leaks that were statistically determined to be real. 
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Figure 5. Transient Leaks Observed on HGDS During PRSD Load, (a) The blue line represents oxygen as read 
by the HGDS plotted with ppm on the y-axis vs. time on the x -axis. Red represents Hydrogen, Green represents 
Argon and black represents Helium, (b) The following was calculated for the system H2 LOD = 2.30 PP; H2 
Resolution = 2.10 PPM; 02 LOD = 0.96 PPM; 02 Resolution = 0.90 PPM.(c) With the low LOD and resolution of 
the HGDS, the system was able to distinguish a 3.8 ppm and 3.4 ppm transient oxygen leak during load. 


H. Time Constraints 

Launch support offers several challenges, but all supporting systems must foremost face finite time constraints. 
This is seen most clearly during ISS missions, where time plays a role in all decisions. When dealing with possible 
leaks there are many time critical functions that impact requirements. The dynamics of a steady state leak consist of 
leak start time, leak migration time, mixing time, transit time to the monitoring system, and finally system analysis 
time. The HGDS system is physically distanced from the areas it is monitoring. It takes time to get the sample from 
the area of interest to the systems to be analyzed. Samples are constantly drawn from three orbiter areas and the 
ET/IT. Sample lines are flow balanced and the transport pumps pull samples down the lines but are limited by line 
conductance and pump capacity. Typically the samples from the orbiter take 15 seconds to reach the mass 
spectrometers. Sample delivery system response is defined in the NSTS 08171, Space Shuttle, Operations and 
Maintenance Requirements Specification (OMRS), FILE VI, VOL. 1, Baseline 14, to be less than 30 seconds from 
the orbiter sample point (either payload bay, midbody, or aft) to RGA first indication (positive increase). The 
samples from the ET/IT take about 50 seconds. In multiplier mode, it takes approximately 1.2 seconds per gas to 
update. To ensure the reading is real and not a noise spike, the rule of thumb is to wait for two consecutive updates, 
which is about another 10 seconds for all gases. Additionally, to confirm the leak with both systems, the analysis 
time is again added. Assuming the leak starts and is picked up by a sample line immediately and that the HGDS is 
already sampling the area of the leak, there is a minimum of 15 seconds delay to detect a leak from leak start in the 
vehicle and a minimum of 1 minute to detect a leak in the ET/IT. To confirm a leak, this takes on the order of 45 
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seconds for a vehicle line (unless both systems are monitoring the same area) and closer to 1 min 20 seconds for the 
ET. 

The last 9 minutes of launch count are the most dynamic and dangerous for leak detection. At this time, the 
vehicle is being configured for flight. This means that valves are being closed that haven’t before, purges are being 
terminated, and areas are being pressurized to pressures they have not been subjected to thus far in processing. 
Other than tanking, this is the most likely time for a leak to develop. The ET requirement originally was effective 
until T-3 1 seconds. After reexamination of the system analysis time, the transit time, and the timing ET automatic 
pressurization to flight pressure, the effectivity of the LCC was moved from T-3 1 seconds to T-5 min. 

At the end of the count, the aft is the primary focus for the HGDS system, as it is the most a hazardous area to 
have a leak, because it is the only orbiter compartment with launch commit criteria still effective and it is still under 
dynamic conditions with fuel flowing from the ET through the aft to the main engines. Therefore, the HGDS is 
monitoring this area and at most one system would be monitoring the ET. To detect a leak in the ET, there must be 
leak start and migration to the HGDS sample port in the ET (at a minimum 5 seconds), then there is the transit time 
down the -300 foot sample line (-50 seconds), and then 2 consecutive updates on one system (-10 seconds). To 
confirm the leak, a second system would then switch over to monitor the sample line, taking about 30 seconds to 
move through the system and be analyzed. Requiring a total of approximately 95 seconds minimum to confirm a 
leak in the ET, a leak started at T-l minute 30 seconds would never be detected prior to launch. Additionally, 
consider the fact that once the leak is confirmed, there has to be action taken to safe the vehicle or isolate the leak. 
The ground launch sequencer (GLS) computer has control of the launch sequence after T-31 seconds and the main 
engines are ignited at approximately T-6seconds. With the perfect circumstances, a leak at T-2 minutes may be able 
to be detected, confirmed, and reacted upon in time to stop the sequence prior to launching with a hazardous 
condition. 

System analysis time can only be reduced so much, but transit times to the system can make a major impact on 
real time monitoring operations. Future operations may be able to mitigate these problems by designing a smaller, 
dedicated mass spectrometer that can be placed closer to the area being monitored. If a mass spectrometer is 
devoted to monitoring 1 area (instead of 4 to 5), then sample time is reduced. If there was an acceptable 
environment for a mass spectrometer (or a more robust system) that could be placed about 50 feet from the ET 
sampling area, instead of 300 feet, then the transit time could be reduced to 1 /6 th , or to roughly 10 seconds. This 
way important dynamics at the end of launch count could be monitored, making launch count conceivably safer. 

The HGDS is completely dependent on the performance of other systems as well. There are several other 
systems that can impact the aft gas concentration signatures monitored by the HGDS. The purges in the various 
areas play a major role in how the HGDS operates. From total purge flow determining leak rate to purge 
composition masking or falsely indicating a problem. Also, main engine and fuel system valves are typically 
actuated by helium. When these are cycled or stuck, there are different indications. Vehicle configurations causing 
higher delta pressures have impacts as do the various payloads. All of these variables factor in to the response taken 
when any indication is observed during launch countdown. Any observation requires expert operator interpretation 
to assimilate all of these different variables and make the correct decision in the small amount of time available. 


I. Future Operations 

Purges on the SSV are either nitrogen or helium. Originally the HGDS was designed to work in either 
background. However, upon installation it was found that the system would not produce a calibration of less than 10 
percent in a helium background. Helium operations are much harder to work because helium behaves differently 
than Nitrogen and is a much harder gas to pump efficiently. Currently, the pumps in the HGDS can handle a helium 
background, however, the components utilized within the system that controls the sample pressure going across the 
inlet to the high vacuum area is not reliable when operating in helium. In the system inlet, the sample goes through 
two orifices for a controlled pressure drop. These orifices were sized for Nitrogen backgrounds to achieve a desired 
inlet pressure range to the mass spectrometer. This inlet pressure range is desirable for nitrogen but not for helium. 
Additionally, the inlet pressure is currently measured by a convectron gauge that is also not compatible with helium. 

In the HGDS lab, more prototyping was performed to determine if a configuration could be achieved that would 
enable the HGDS to operate reliably in a Helium background. Prototyping determined that if the inlet pressure 
gauge was changed to one that is compatible with helium, a capacitance manometer, and accommodated via 
software to function in a control system, then controlling the inlet pressure to the mass spectrometer would allow for 
the HGDS to operate in a helium background. The inlet pressure would be controlled, in addition to the sample 
pressure, and would have a set point for Nitrogen backgrounds and a set point for helium backgrounds. This 
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configuration would allow the inlet pressure to be optimized for both backgrounds. Additionally, a software change 
would have to be implemented to ensure the software automatically changed these set points according to the 
background in which the system was currently operating. 

Currently, the HGDS cannot monitor three critical areas during launch because it does not operate within 
tolerance in a helium background. Additionally, it cannot be used to support several critical interface leak checks 
during the processing flow. In the future, a hardware modification to control the inlet pressure and a software 
modification to make the set points and configuration for each background seamless and automatic would complete 
the total versatility of the system. This would provide another level of redundancy to other monitoring systems, as 
well higher fidelity in these areas over the other systems. This would effectively add another level of safety to the 
entire process. > > 


IV. Conclusion 

The Hazardous Gas Detection System was well designed and far better than its predecessor. Design, however, 
cannot account for 100% of the operational concerns faced during various phases processing and launch support. 
An optimum design can allow the system to be adapted and evolve as operational requirements demand. The HGDS 
has gone through several major modifications to address concerns that were not obvious until providing operational 
support. The system software, turbo pumps, sample pumps, roughing pumps, transport pumps, inlet block, high 
vacuum chamber, and exhaust system have all been modified and upgraded since system installation. Additionally, , 
the operational procedures have been continually modified and tweaked to optimize the performance of the HGDS 
across all operations. The HGDS has now been used as the primary system responsible for monitoring fuel and 
oxidizer leaks within the orbiter and external tank for over twenty space shuttle vehicle launches and continues to 
improve with each launch. Each use provides new operational data and provides a more extensive operational 
database to ensure the HGDS will continue to be a reliable and constantly improving launch support system. 
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